new files from source

Infrastrucutre as Code/Ansible/roles/cis_hardening/ssh_hardening/defaults/main.yml

@@ -0,0 +1,32 @@
+---
+# General settings
+ssh_protocol: 2
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_challenge_response_authentication: "no"
+ssh_kerberos_authentication: "no"
+ssh_gssapi_authentication: "no"
+ssh_use_pam: "yes"
+PrintLastLog: "yes"
+
+# Session security
+ssh_x11_forwarding: "no"
+ssh_allow_tcp_forwarding: "yes"
+ssh_permit_tunnel: "no"
+ssh_allow_agent_forwarding: "no"
+
+# Idle timeout / login attempts
+ssh_client_alive_interval: 300
+ssh_client_alive_count_max: 3
+ssh_login_grace_time: 60
+ssh_max_auth_tries: 3
+ssh_max_sessions: 2
+ssh_max_startups: "10:30:60"
+
+# SSH access restrictions
+ssh_allow_users: "adminuser ansibleuser"
+
+# Strong encryption
+ssh_ciphers: "aes256-ctr,aes192-ctr,aes128-ctr"
+ssh_macs: "hmac-sha2-512,hmac-sha2-256"
+ssh_kex_algorithms: "[email protected],diffie-hellman-group-exchange-sha256"

Infrastrucutre as Code/Ansible/roles/cis_hardening/ssh_hardening/tasks/main.yml

@@ -0,0 +1,82 @@
+---
+- name: Ensure OpenSSH server is installed
+  ansible.builtin.package:
+    name: openssh-server
+    state: present
+
+- name: Ensure SSH daemon is enabled and running
+  ansible.builtin.service:
+    name: sshd
+    enabled: true
+    state: started
+
+- name: Backup current sshd_config
+  ansible.builtin.copy:
+    src: /etc/ssh/sshd_config
+    dest: /etc/ssh/sshd_config.bak
+    owner: root
+    group: root
+    mode: "0600"
+    remote_src: true
+
+- name: Harden SSH configuration
+  ansible.builtin.lineinfile:
+    path: /etc/ssh/sshd_config
+    regexp: "{{ ssh_item.regexp }}"
+    line: "{{ ssh_item.line }}"
+    state: present
+    backrefs: yes
+  loop:
+    - regexp: "^#?Protocol"
+      line: "Protocol {{ ssh_protocol }}"
+    - regexp: "^#?PermitRootLogin"
+      line: "PermitRootLogin {{ ssh_permit_root_login }}"
+    - regexp: "^#?PasswordAuthentication"
+      line: "PasswordAuthentication {{ ssh_password_authentication }}"
+    - regexp: "^#?ChallengeResponseAuthentication"
+      line: "ChallengeResponseAuthentication {{ ssh_challenge_response_authentication }}"
+    - regexp: "^#?KerberosAuthentication"
+      line: "KerberosAuthentication {{ ssh_kerberos_authentication }}"
+    - regexp: "^#?GSSAPIAuthentication"
+      line: "GSSAPIAuthentication {{ ssh_gssapi_authentication }}"
+    - regexp: "^#?UsePAM"
+      line: "UsePAM {{ ssh_use_pam }}"
+    - regexp: "^#?X11Forwarding"
+      line: "X11Forwarding {{ ssh_x11_forwarding }}"
+    - regexp: "^#?AllowTcpForwarding"
+      line: "AllowTcpForwarding {{ ssh_allow_tcp_forwarding }}"
+    - regexp: "^#?PermitTunnel"
+      line: "PermitTunnel {{ ssh_permit_tunnel }}"
+    - regexp: "^#?AllowAgentForwarding"
+      line: "AllowAgentForwarding {{ ssh_allow_agent_forwarding }}"
+    - regexp: "^#?ClientAliveInterval"
+      line: "ClientAliveInterval {{ ssh_client_alive_interval }}"
+    - regexp: "^#?ClientAliveCountMax"
+      line: "ClientAliveCountMax {{ ssh_client_alive_count_max }}"
+    - regexp: "^#?LoginGraceTime"
+      line: "LoginGraceTime {{ ssh_login_grace_time }}"
+    - regexp: "^#?MaxAuthTries"
+      line: "MaxAuthTries {{ ssh_max_auth_tries }}"
+    - regexp: "^#?MaxSessions"
+      line: "MaxSessions {{ ssh_max_sessions }}"
+    - regexp: "^#?MaxStartups"
+      line: "MaxStartups {{ ssh_max_startups }}"
+    - regexp: "^#?Ciphers"
+      line: "Ciphers {{ ssh_ciphers }}"
+    - regexp: "^#?MACs"
+      line: "MACs {{ ssh_macs }}"
+    - regexp: "^#?KexAlgorithms"
+      line: "KexAlgorithms {{ ssh_kex_algorithms }}"
+    - regexp: "^#?PrintLastLog"
+      line: "PrintLastLog {{ PrintLastLog }}"
+    - regexp: '^\s*#?\s*AllowUsers'
+      line: "AllowUsers {{ ssh_allow_users }}"
+    - regexp: "^#?Banner"
+      line: "Banner /etc/issue.net"
+  loop_control:
+    loop_var: ssh_item
+
+- name: Restart SSH service to apply changes
+  ansible.builtin.service:
+    name: sshd
+    state: restarted